diff --git a/app/accounts/__init__.py b/app/accounts/__init__.py index fdf6aaa..dc587af 100644 --- a/app/accounts/__init__.py +++ b/app/accounts/__init__.py @@ -28,6 +28,22 @@ def create_account(username, email, password): raise ValueError("Account with given parameters already exists") +def update_account_role(account_id, role_id): + """ + Tries to update account role + + :param account_id: Target account id + :param role_id: New role role_id + :type account_id: int + :type role_id: int + :returns: True if role is updated successfully + :rtype: Boolean + """ + acc = Account.get(id=account_id) + acc.role_id = role_id + acc.save() + + def create_token(username, password): """ Tries to create token for account with given parameters. diff --git a/app/api/__init__.py b/app/api/__init__.py index 499e2db..24fc08f 100644 --- a/app/api/__init__.py +++ b/app/api/__init__.py @@ -38,7 +38,9 @@ class ProtectedResource(Resource): def add_resources(): - from .resources.account import AccountResource, AccountListResource + from .resources.account import (AccountResource, + AccountListResource, + AccountRoleResource) from .resources.token import TokenResource, ValidateTokenResource from .resources.device import (DeviceResource, DeviceRecordingResource, @@ -50,6 +52,7 @@ def add_resources(): api.add_resource(AccountResource, '/v1/accounts/') api.add_resource(AccountListResource, '/v1/accounts') + api.add_resource(AccountRoleResource, '/v1/accounts//role') api.add_resource(TokenResource, '/v1/token') api.add_resource(ValidateTokenResource, '/v1/token/validate') api.add_resource(DeviceResource, '/v1/devices/') diff --git a/app/api/resources/account.py b/app/api/resources/account.py index 11fc505..2933064 100644 --- a/app/api/resources/account.py +++ b/app/api/resources/account.py @@ -13,6 +13,10 @@ class UserSchema(Schema): password = fields.Str(required=True, load_only=True) +class RoleUpdateSchema(Schema): + role_id = fields.Integer(required=True, load_only=True, location='json') + + class UserWrapperSchema(Schema): user = fields.Nested(UserSchema, required=True, location='json') @@ -25,6 +29,18 @@ class AccountResource(ProtectedResource): abort(403, message='You can only get your own account', status='error') +class AccountRoleResource(ProtectedResource): + @use_args(RoleUpdateSchema()) + @swag_from('swagger/update_account_role_spec.yaml') + def put(self, args, account_id): + if g.current_account.id == account_id: + abort(403, message='You may not change your own roles', + status='error') + success = accounts.update_account_role(account_id, args['role_id']) + if success: + return '', 204 + + class AccountListResource(Resource): @use_args(UserWrapperSchema()) @swag_from('swagger/create_account_spec.yaml') diff --git a/app/api/resources/swagger/update_account_role_spec.yaml b/app/api/resources/swagger/update_account_role_spec.yaml new file mode 100644 index 0000000..26de064 --- /dev/null +++ b/app/api/resources/swagger/update_account_role_spec.yaml @@ -0,0 +1,24 @@ +Updates an account role +--- +tags: + - Account + - Role +parameters: + - in: path + name: account_id + required: true + type: integer + description: Id of the account + - in: body + name: body + required: true + schema: + type: object + required: + - role_id + properties: + role_id: + type: integer +responses: + 204: + description: Success